From 0863ea479409f478b9b4edfa8214d95a342fb468 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Fri, 20 Dec 2024 02:55:34 -0800
Subject: [PATCH] [threat-actors] Add UNC2465

---
 clusters/threat-actor.json | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index cb58587..0dc7848 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -17561,6 +17561,18 @@
       },
       "uuid": "ceabe862-3d89-4696-9d7f-32a4850334d9",
       "value": "Aggressive Inventory Zombies"
+    },
+    {
+      "description": "UNC2465 is a threat actor known for deploying the SMOKEDHAM .NET backdoor and DARKSIDE ransomware, utilizing TTPs such as phishing, Trojanized software installers, and supply chain attacks. They have employed the NGROK utility to expose internal services and facilitate lateral movement within victim environments. UNC2465 has also leveraged tools like UltraVNC, Cobalt Strike BEACON, and conducted credential harvesting via LSASS memory dumping. Their operations have included extortion tactics through a leaks website over TOR, applying pressure on victims by releasing stolen data.",
+      "meta": {
+        "refs": [
+          "https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations",
+          "https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise",
+          "https://cloud.google.com/blog/topics/threat-intelligence/burrowing-your-way-into-vpns"
+        ]
+      },
+      "uuid": "cbdf8d63-c114-47d5-8f32-f87f365c7c43",
+      "value": "UNC2465"
     }
   ],
   "version": 321